From 70018a52cb8a9909257c5f74a6ddfa7a2b797757 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 14 Jan 2008 15:09:25 -0800 Subject: [PATCH] more 2.6.23 patches added --- .../fix-sparc64-cpu-cross-call-hangs.patch | 109 ++++++++++++++ ...areful-when-changing-vid-input-level.patch | 77 ---------- ...ix-potential-dst-leak-in-xfrm_lookup.patch | 63 +++++++++ ...engthen-check-on-validity-of-iph-ihl.patch | 50 +++++++ queue-2.6.23/series | 8 +- ...troller-register-access-when-non-smp.patch | 72 ++++++++++ ...two-kernel-linear-mapping-setup-bugs.patch | 133 ++++++++++++++++++ ...-by-wait_event_interruptible_timeout.patch | 56 ++++++++ .../vlan-lost-rtnl_unlock-in-vlan_ioctl.patch | 36 +++++ 9 files changed, 526 insertions(+), 78 deletions(-) create mode 100644 queue-2.6.23/fix-sparc64-cpu-cross-call-hangs.patch delete mode 100644 queue-2.6.23/hwmon-be-more-careful-when-changing-vid-input-level.patch create mode 100644 queue-2.6.23/ipsec-fix-potential-dst-leak-in-xfrm_lookup.patch create mode 100644 queue-2.6.23/ipv4-raw-strengthen-check-on-validity-of-iph-ihl.patch create mode 100644 queue-2.6.23/sparc64-fix-memory-controller-register-access-when-non-smp.patch create mode 100644 queue-2.6.23/sparc64-fix-two-kernel-linear-mapping-setup-bugs.patch create mode 100644 queue-2.6.23/tty-fix-logic-change-introduced-by-wait_event_interruptible_timeout.patch create mode 100644 queue-2.6.23/vlan-lost-rtnl_unlock-in-vlan_ioctl.patch diff --git a/queue-2.6.23/fix-sparc64-cpu-cross-call-hangs.patch b/queue-2.6.23/fix-sparc64-cpu-cross-call-hangs.patch new file mode 100644 index 00000000000..23de31e93e1 --- /dev/null +++ b/queue-2.6.23/fix-sparc64-cpu-cross-call-hangs.patch @@ -0,0 +1,109 @@ +From stable-bounces@linux.kernel.org Wed Dec 19 15:50:31 2007 +From: David Miller +Date: Wed, 19 Dec 2007 15:50:06 -0800 (PST) +Subject: [stable] [PATCH]: Fix sparc64 cpu cross call hangs. +To: stable@kernel.org +Cc: bunk@kernel.org +Message-ID: <20071219.155006.86794054.davem@davemloft.net> + + + +Adrian, this patch needs a little bit of backporting for +2.6.16, which I will send to you in the next email. + +Please add to -stable, this fits both 2.6.22 and 2.6.23 +and I think since it hangs people's systems it is +appropriate for both :-) + +Thanks! + +[SPARC64]: Fix endless loop in cheetah_xcall_deliver(). + +[ Upsteam commit: 0de56d1ab83323d604d95ca193dcbd28388dbabb ] + +We need to mask out the proper bits when testing the dispatch status +register else we can see unrelated NACK bits from previous cross call +sends. + +Signed-off-by: David S. Miller +--- + arch/sparc64/kernel/smp.c | 19 +++++++++++++------ + 1 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c +index 894b506..c399449 100644 +--- a/arch/sparc64/kernel/smp.c ++++ b/arch/sparc64/kernel/smp.c +@@ -476,7 +476,7 @@ static inline void spitfire_xcall_deliver(u64 data0, u64 data1, u64 data2, cpuma + */ + static void cheetah_xcall_deliver(u64 data0, u64 data1, u64 data2, cpumask_t mask) + { +- u64 pstate, ver; ++ u64 pstate, ver, busy_mask; + int nack_busy_id, is_jbus, need_more; + + if (cpus_empty(mask)) +@@ -508,14 +508,20 @@ retry: + "i" (ASI_INTR_W)); + + nack_busy_id = 0; ++ busy_mask = 0; + { + int i; + + for_each_cpu_mask(i, mask) { + u64 target = (i << 14) | 0x70; + +- if (!is_jbus) ++ if (is_jbus) { ++ busy_mask |= (0x1UL << (i * 2)); ++ } else { + target |= (nack_busy_id << 24); ++ busy_mask |= (0x1UL << ++ (nack_busy_id * 2)); ++ } + __asm__ __volatile__( + "stxa %%g0, [%0] %1\n\t" + "membar #Sync\n\t" +@@ -531,15 +537,16 @@ retry: + + /* Now, poll for completion. */ + { +- u64 dispatch_stat; ++ u64 dispatch_stat, nack_mask; + long stuck; + + stuck = 100000 * nack_busy_id; ++ nack_mask = busy_mask << 1; + do { + __asm__ __volatile__("ldxa [%%g0] %1, %0" + : "=r" (dispatch_stat) + : "i" (ASI_INTR_DISPATCH_STAT)); +- if (dispatch_stat == 0UL) { ++ if (!(dispatch_stat & (busy_mask | nack_mask))) { + __asm__ __volatile__("wrpr %0, 0x0, %%pstate" + : : "r" (pstate)); + if (unlikely(need_more)) { +@@ -556,12 +563,12 @@ retry: + } + if (!--stuck) + break; +- } while (dispatch_stat & 0x5555555555555555UL); ++ } while (dispatch_stat & busy_mask); + + __asm__ __volatile__("wrpr %0, 0x0, %%pstate" + : : "r" (pstate)); + +- if ((dispatch_stat & ~(0x5555555555555555UL)) == 0) { ++ if (dispatch_stat & busy_mask) { + /* Busy bits will not clear, continue instead + * of freezing up on this cpu. + */ +-- +1.5.3.7 + +_______________________________________________ +stable mailing list +stable@linux.kernel.org +http://linux.kernel.org/mailman/listinfo/stable + diff --git a/queue-2.6.23/hwmon-be-more-careful-when-changing-vid-input-level.patch b/queue-2.6.23/hwmon-be-more-careful-when-changing-vid-input-level.patch deleted file mode 100644 index f31782fa3ee..00000000000 --- a/queue-2.6.23/hwmon-be-more-careful-when-changing-vid-input-level.patch +++ /dev/null @@ -1,77 +0,0 @@ -From stable-bounces@linux.kernel.org Sun Jan 6 05:19:14 2008 -From: Jean Delvare -Date: Sun, 6 Jan 2008 14:18:44 +0100 -Subject: hwmon: (w83627ehf) Be more careful when changing VID input level -To: stable@kernel.org -Cc: "Mark M. Hoffman" -Message-ID: <20080106141844.59571bf7@hyperion.delvare> - -Already in Linus' tree: -http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=58e6e78119da2bdade9f6f588155f0320072b76b - -Fix for: -http://bugzilla.kernel.org/show_bug.cgi?id=9634 - -The VID input level change has been reported to cause trouble. Be more -careful in this respect: -* Only change the level on the W83627EHF/EHG. The W83627DHG is more - complex in this respect. -* Don't change the level if the VID pins are in output mode. -* Only set the level to TTL if VRM 9.x is used. - -Signed-off-by: Jean Delvare -Signed-off-by: Mark M. Hoffman -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/hwmon/w83627ehf.c | 36 ++++++++++++++++++++++-------------- - 1 file changed, 22 insertions(+), 14 deletions(-) - ---- a/drivers/hwmon/w83627ehf.c -+++ b/drivers/hwmon/w83627ehf.c -@@ -1276,23 +1276,31 @@ static int __devinit w83627ehf_probe(str - - data->vrm = vid_which_vrm(); - superio_enter(sio_data->sioreg); -- /* Set VID input sensibility if needed. In theory the BIOS should -- have set it, but in practice it's not always the case. */ -- en_vrm10 = superio_inb(sio_data->sioreg, SIO_REG_EN_VRM10); -- if ((en_vrm10 & 0x08) && data->vrm != 100) { -- dev_warn(dev, "Setting VID input voltage to TTL\n"); -- superio_outb(sio_data->sioreg, SIO_REG_EN_VRM10, -- en_vrm10 & ~0x08); -- } else if (!(en_vrm10 & 0x08) && data->vrm == 100) { -- dev_warn(dev, "Setting VID input voltage to VRM10\n"); -- superio_outb(sio_data->sioreg, SIO_REG_EN_VRM10, -- en_vrm10 | 0x08); -- } - /* Read VID value */ - superio_select(sio_data->sioreg, W83627EHF_LD_HWM); -- if (superio_inb(sio_data->sioreg, SIO_REG_VID_CTRL) & 0x80) -+ if (superio_inb(sio_data->sioreg, SIO_REG_VID_CTRL) & 0x80) { -+ /* Set VID input sensibility if needed. In theory the BIOS -+ should have set it, but in practice it's not always the -+ case. We only do it for the W83627EHF/EHG because the -+ W83627DHG is more complex in this respect. */ -+ if (sio_data->kind == w83627ehf) { -+ en_vrm10 = superio_inb(sio_data->sioreg, -+ SIO_REG_EN_VRM10); -+ if ((en_vrm10 & 0x08) && data->vrm == 90) { -+ dev_warn(dev, "Setting VID input voltage to " -+ "TTL\n"); -+ superio_outb(sio_data->sioreg, SIO_REG_EN_VRM10, -+ en_vrm10 & ~0x08); -+ } else if (!(en_vrm10 & 0x08) && data->vrm == 100) { -+ dev_warn(dev, "Setting VID input voltage to " -+ "VRM10\n"); -+ superio_outb(sio_data->sioreg, SIO_REG_EN_VRM10, -+ en_vrm10 | 0x08); -+ } -+ } -+ - data->vid = superio_inb(sio_data->sioreg, SIO_REG_VID_DATA) & 0x3f; -- else { -+ } else { - dev_info(dev, "VID pins in output mode, CPU VID not " - "available\n"); - data->vid = 0x3f; diff --git a/queue-2.6.23/ipsec-fix-potential-dst-leak-in-xfrm_lookup.patch b/queue-2.6.23/ipsec-fix-potential-dst-leak-in-xfrm_lookup.patch new file mode 100644 index 00000000000..5111b921912 --- /dev/null +++ b/queue-2.6.23/ipsec-fix-potential-dst-leak-in-xfrm_lookup.patch @@ -0,0 +1,63 @@ +From stable-bounces@linux.kernel.org Wed Dec 19 16:36:18 2007 +From: Herbert Xu +Date: Wed, 19 Dec 2007 16:35:54 -0800 (PST) +Subject: IPSEC: Fix potential dst leak in xfrm_lookup +To: stable@kernel.org +Cc: bunk@kernel.org +Message-ID: <20071219.163554.93686534.davem@davemloft.net> + +From: Herbert Xu + +[IPSEC]: Fix potential dst leak in xfrm_lookup + +[ Upstream commit: 75b8c133267053c9986a7c8db5131f0e7349e806 ] + +If we get an error during the actual policy lookup we don't free the +original dst while the caller expects us to always free the original +dst in case of error. + +This patch fixes that. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/xfrm/xfrm_policy.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1479,8 +1479,9 @@ restart: + + if (sk && sk->sk_policy[1]) { + policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl); ++ err = PTR_ERR(policy); + if (IS_ERR(policy)) +- return PTR_ERR(policy); ++ goto dropdst; + } + + if (!policy) { +@@ -1491,8 +1492,9 @@ restart: + + policy = flow_cache_lookup(fl, dst_orig->ops->family, + dir, xfrm_policy_lookup); ++ err = PTR_ERR(policy); + if (IS_ERR(policy)) +- return PTR_ERR(policy); ++ goto dropdst; + } + + if (!policy) +@@ -1661,8 +1663,9 @@ restart: + return 0; + + error: +- dst_release(dst_orig); + xfrm_pols_put(pols, npols); ++dropdst: ++ dst_release(dst_orig); + *dst_p = NULL; + return err; + } diff --git a/queue-2.6.23/ipv4-raw-strengthen-check-on-validity-of-iph-ihl.patch b/queue-2.6.23/ipv4-raw-strengthen-check-on-validity-of-iph-ihl.patch new file mode 100644 index 00000000000..e5e5998faa8 --- /dev/null +++ b/queue-2.6.23/ipv4-raw-strengthen-check-on-validity-of-iph-ihl.patch @@ -0,0 +1,50 @@ +From stable-bounces@linux.kernel.org Fri Jan 11 01:10:17 2008 +From: Herbert Xu +Date: Fri, 11 Jan 2008 01:09:46 -0800 (PST) +Subject: IPV4 raw: Strengthen check on validity of iph->ihl +To: stable@kernel.org +Cc: bunk@kernel.org +Message-ID: <20080111.010946.227858962.davem@davemloft.net> + +From: Herbert Xu + +[IPV4] raw: Strengthen check on validity of iph->ihl + +[ Upstream commit: f844c74fe07321953e2dd227fe35280075f18f60 ] + +We currently check that iph->ihl is bounded by the real length and that +the real length is greater than the minimum IP header length. However, +we did not check the caes where iph->ihl is less than the minimum IP +header length. + +This breaks because some ip_fast_csum implementations assume that which +is quite reasonable. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/raw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -270,6 +270,7 @@ static int raw_send_hdrinc(struct sock * + int hh_len; + struct iphdr *iph; + struct sk_buff *skb; ++ unsigned int iphlen; + int err; + + if (length > rt->u.dst.dev->mtu) { +@@ -303,7 +304,8 @@ static int raw_send_hdrinc(struct sock * + goto error_fault; + + /* We don't modify invalid header */ +- if (length >= sizeof(*iph) && iph->ihl * 4U <= length) { ++ iphlen = iph->ihl * 4; ++ if (iphlen >= sizeof(*iph) && iphlen <= length) { + if (!iph->saddr) + iph->saddr = rt->rt_src; + iph->check = 0; diff --git a/queue-2.6.23/series b/queue-2.6.23/series index 6730ae63ffa..136bc113e28 100644 --- a/queue-2.6.23/series +++ b/queue-2.6.23/series @@ -1,6 +1,12 @@ -hwmon-be-more-careful-when-changing-vid-input-level.patch +fix-sparc64-cpu-cross-call-hangs.patch dm-table-detect-io-beyond-device.patch dm-crypt-fix-write-endio.patch dm-crypt-use-bio_add_page.patch acpi-video_device_list-corruption.patch acpi-thinkpad-acpi-fix-lenovo-keymap-for-brightness.patch +sparc64-fix-memory-controller-register-access-when-non-smp.patch +sparc64-fix-two-kernel-linear-mapping-setup-bugs.patch +ipsec-fix-potential-dst-leak-in-xfrm_lookup.patch +vlan-lost-rtnl_unlock-in-vlan_ioctl.patch +tty-fix-logic-change-introduced-by-wait_event_interruptible_timeout.patch +ipv4-raw-strengthen-check-on-validity-of-iph-ihl.patch diff --git a/queue-2.6.23/sparc64-fix-memory-controller-register-access-when-non-smp.patch b/queue-2.6.23/sparc64-fix-memory-controller-register-access-when-non-smp.patch new file mode 100644 index 00000000000..1b521628e60 --- /dev/null +++ b/queue-2.6.23/sparc64-fix-memory-controller-register-access-when-non-smp.patch @@ -0,0 +1,72 @@ +From stable-bounces@linux.kernel.org Wed Dec 19 16:27:31 2007 +From: David Miller +Date: Wed, 19 Dec 2007 16:27:11 -0800 (PST) +Subject: SPARC64: Fix memory controller register access when non-SMP. +To: stable@kernel.org +Cc: bunk@stable.org +Message-ID: <20071219.162711.06329560.davem@davemloft.net> + + +From: David Miller + +[SPARC64]: Fix memory controller register access when non-SMP. + +[ Upstream commit: b332b8bc9c67165eabdfc7d10b4a2e4cc9f937d0 ] + +get_cpu() always returns zero on non-SMP builds, but we +really want the physical cpu number in this code in order +to do the right thing. + +Based upon a non-SMP kernel boot failure report from Bernd Zeimetz. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc64/kernel/chmc.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/arch/sparc64/kernel/chmc.c ++++ b/arch/sparc64/kernel/chmc.c +@@ -1,7 +1,6 @@ +-/* $Id: chmc.c,v 1.4 2002/01/08 16:00:14 davem Exp $ +- * memctrlr.c: Driver for UltraSPARC-III memory controller. ++/* memctrlr.c: Driver for UltraSPARC-III memory controller. + * +- * Copyright (C) 2001 David S. Miller (davem@redhat.com) ++ * Copyright (C) 2001, 2007 David S. Miller (davem@davemloft.net) + */ + + #include +@@ -16,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -242,8 +242,11 @@ int chmc_getunumber(int syndrome_code, + */ + static u64 read_mcreg(struct mctrl_info *mp, unsigned long offset) + { +- unsigned long ret; +- int this_cpu = get_cpu(); ++ unsigned long ret, this_cpu; ++ ++ preempt_disable(); ++ ++ this_cpu = real_hard_smp_processor_id(); + + if (mp->portid == this_cpu) { + __asm__ __volatile__("ldxa [%1] %2, %0" +@@ -255,7 +258,8 @@ static u64 read_mcreg(struct mctrl_info + : "r" (mp->regs + offset), + "i" (ASI_PHYS_BYPASS_EC_E)); + } +- put_cpu(); ++ ++ preempt_enable(); + + return ret; + } diff --git a/queue-2.6.23/sparc64-fix-two-kernel-linear-mapping-setup-bugs.patch b/queue-2.6.23/sparc64-fix-two-kernel-linear-mapping-setup-bugs.patch new file mode 100644 index 00000000000..f07e06c6566 --- /dev/null +++ b/queue-2.6.23/sparc64-fix-two-kernel-linear-mapping-setup-bugs.patch @@ -0,0 +1,133 @@ +From stable-bounces@linux.kernel.org Wed Dec 19 16:29:22 2007 +From: David Miller +Date: Wed, 19 Dec 2007 16:28:57 -0800 (PST) +Subject: SPARC64: Fix two kernel linear mapping setup bugs. +To: stable@kernel.org +Cc: bunk@kernel.org +Message-ID: <20071219.162857.239562660.davem@davemloft.net> + +From: David Miller + +[SPARC64]: Fix two kernel linear mapping setup bugs. + +[ Upstream commit: 8f361453d8e9a67c85b2cf9b93c642c2d8fe0462 ] + +This was caught and identified by Greg Onufer. + +Since we setup the 256M/4M bitmap table after taking over the trap +table, it's possible for some 4M mapping to get loaded in the TLB +beforhand which later will be 256M mappings. + +This can cause illegal TLB multiple-match conditions. Fix this by +setting up the bitmap before we take over the trap table. + +Next, __flush_tlb_all() was not doing anything on hypervisor +platforms. Fix by adding sun4v_mmu_demap_all() and calling it. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc64/kernel/entry.S | 12 ++++++++++++ + arch/sparc64/mm/init.c | 29 ++++++++++++++++++++--------- + include/asm-sparc64/hypervisor.h | 4 ++++ + 3 files changed, 36 insertions(+), 9 deletions(-) + +--- a/arch/sparc64/kernel/entry.S ++++ b/arch/sparc64/kernel/entry.S +@@ -2593,3 +2593,15 @@ sun4v_mmustat_info: + retl + nop + .size sun4v_mmustat_info, .-sun4v_mmustat_info ++ ++ .globl sun4v_mmu_demap_all ++ .type sun4v_mmu_demap_all,#function ++sun4v_mmu_demap_all: ++ clr %o0 ++ clr %o1 ++ mov HV_MMU_ALL, %o2 ++ mov HV_FAST_MMU_DEMAP_ALL, %o5 ++ ta HV_FAST_TRAP ++ retl ++ nop ++ .size sun4v_mmu_demap_all, .-sun4v_mmu_demap_all +--- a/arch/sparc64/mm/init.c ++++ b/arch/sparc64/mm/init.c +@@ -1135,14 +1135,9 @@ static void __init mark_kpte_bitmap(unsi + } + } + +-static void __init kernel_physical_mapping_init(void) ++static void __init init_kpte_bitmap(void) + { + unsigned long i; +-#ifdef CONFIG_DEBUG_PAGEALLOC +- unsigned long mem_alloced = 0UL; +-#endif +- +- read_obp_memory("reg", &pall[0], &pall_ents); + + for (i = 0; i < pall_ents; i++) { + unsigned long phys_start, phys_end; +@@ -1151,14 +1146,24 @@ static void __init kernel_physical_mappi + phys_end = phys_start + pall[i].reg_size; + + mark_kpte_bitmap(phys_start, phys_end); ++ } ++} + ++static void __init kernel_physical_mapping_init(void) ++{ + #ifdef CONFIG_DEBUG_PAGEALLOC ++ unsigned long i, mem_alloced = 0UL; ++ ++ for (i = 0; i < pall_ents; i++) { ++ unsigned long phys_start, phys_end; ++ ++ phys_start = pall[i].phys_addr; ++ phys_end = phys_start + pall[i].reg_size; ++ + mem_alloced += kernel_map_range(phys_start, phys_end, + PAGE_KERNEL); +-#endif + } + +-#ifdef CONFIG_DEBUG_PAGEALLOC + printk("Allocated %ld bytes for kernel page tables.\n", + mem_alloced); + +@@ -1400,6 +1405,10 @@ void __init paging_init(void) + + inherit_prom_mappings(); + ++ read_obp_memory("reg", &pall[0], &pall_ents); ++ ++ init_kpte_bitmap(); ++ + /* Ok, we can use our TLB miss and window trap handlers safely. */ + setup_tba(); + +@@ -1854,7 +1863,9 @@ void __flush_tlb_all(void) + "wrpr %0, %1, %%pstate" + : "=r" (pstate) + : "i" (PSTATE_IE)); +- if (tlb_type == spitfire) { ++ if (tlb_type == hypervisor) { ++ sun4v_mmu_demap_all(); ++ } else if (tlb_type == spitfire) { + for (i = 0; i < 64; i++) { + /* Spitfire Errata #32 workaround */ + /* NOTE: Always runs on spitfire, so no +--- a/include/asm-sparc64/hypervisor.h ++++ b/include/asm-sparc64/hypervisor.h +@@ -709,6 +709,10 @@ extern unsigned long sun4v_mmu_tsb_ctx0( + */ + #define HV_FAST_MMU_DEMAP_ALL 0x24 + ++#ifndef __ASSEMBLY__ ++extern void sun4v_mmu_demap_all(void); ++#endif ++ + /* mmu_map_perm_addr() + * TRAP: HV_FAST_TRAP + * FUNCTION: HV_FAST_MMU_MAP_PERM_ADDR diff --git a/queue-2.6.23/tty-fix-logic-change-introduced-by-wait_event_interruptible_timeout.patch b/queue-2.6.23/tty-fix-logic-change-introduced-by-wait_event_interruptible_timeout.patch new file mode 100644 index 00000000000..19e23daee0d --- /dev/null +++ b/queue-2.6.23/tty-fix-logic-change-introduced-by-wait_event_interruptible_timeout.patch @@ -0,0 +1,56 @@ +From stable-bounces@linux.kernel.org Sun Dec 23 12:35:55 2007 +From: "Cory T. Tusar" +Date: Sun, 23 Dec 2007 12:34:51 -0800 +Subject: tty: fix logic change introduced by wait_event_interruptible_timeout() +To: torvalds@linux-foundation.org +Cc: ctusar@videon-central.com, akpm@linux-foundation.org, jirislaby@gmail.com, alan@lxorguk.ukuu.org.uk, stable@kernel.org +Message-ID: <200712232035.lBNKZEgn007791@imap1.linux-foundation.org> + + +From: "Cory T. Tusar" + +patch db99247ac68fc352100090ad7704fb5efb9327b6 in mainline. + +Commit 5a52bd4a2dcb570333ce6fe2e16cd311650dbdc8 introduced a subtle logic +change in tty_wait_until_sent(). The original version would only error out +of the 'do { ... } while (timeout)' loop if signal_pending() evaluated to +true; a timeout or break due to an empty buffer would fall out of the loop +and into the tty->driver->wait_until_sent handling. The current +implementation will error out on either a pending signal or an empty +buffer, falling through to the tty->driver->wait_until_sent handling only +on a timeout. + +The ->wait_until_sent() will not be reached if the buffer empties before +timeout jiffies have elapsed. This behavior differs from that prior to commit +5a52bd4a2dcb570333ce6fe2e16cd311650dbdc8. + +I turned this up while using a little serial download utility to bootstrap an +ARM-based eval board. The util worked fine on 2.6.22.x, but consistently +failed on 2.6.23.x. Once I'd determined that, I narrowed things down with git +bisect, and found the above difference in logic in tty_wait_until_sent() by +inspection. + +This change reverts the logic flow in tty_wait_until_sent() to match that +prior to the aforementioned commit. + +Signed-off-by: Cory T. Tusar +Cc: Alan Cox +Acked-by: Jiri Slaby +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tty_ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/tty_ioctl.c ++++ b/drivers/char/tty_ioctl.c +@@ -62,7 +62,7 @@ void tty_wait_until_sent(struct tty_stru + if (!timeout) + timeout = MAX_SCHEDULE_TIMEOUT; + if (wait_event_interruptible_timeout(tty->write_wait, +- !tty->driver->chars_in_buffer(tty), timeout)) ++ !tty->driver->chars_in_buffer(tty), timeout) < 0) + return; + if (tty->driver->wait_until_sent) + tty->driver->wait_until_sent(tty, timeout); diff --git a/queue-2.6.23/vlan-lost-rtnl_unlock-in-vlan_ioctl.patch b/queue-2.6.23/vlan-lost-rtnl_unlock-in-vlan_ioctl.patch new file mode 100644 index 00000000000..d460554ad8c --- /dev/null +++ b/queue-2.6.23/vlan-lost-rtnl_unlock-in-vlan_ioctl.patch @@ -0,0 +1,36 @@ +From stable-bounces@linux.kernel.org Wed Dec 19 16:31:34 2007 +From: Pavel Emelyanov +Date: Wed, 19 Dec 2007 16:30:48 -0800 (PST) +Subject: VLAN: Lost rtnl_unlock() in vlan_ioctl() +To: stable@kernel.org +Cc: bunk@stable.org +Message-ID: <20071219.163048.180596355.davem@davemloft.net> + +From: Pavel Emelyanov + +[VLAN]: Lost rtnl_unlock() in vlan_ioctl() + +[ Upstream commit: e35de02615f97b785dc6f73cba421cea06bcbd10 ] + +The SET_VLAN_NAME_TYPE_CMD command w/o CAP_NET_ADMIN capability +doesn't release the rtnl lock. + +Signed-off-by: Pavel Emelyanov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/8021q/vlan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/8021q/vlan.c ++++ b/net/8021q/vlan.c +@@ -768,7 +768,7 @@ static int vlan_ioctl_handler(void __use + case SET_VLAN_NAME_TYPE_CMD: + err = -EPERM; + if (!capable(CAP_NET_ADMIN)) +- return -EPERM; ++ break; + if ((args.u.name_type >= 0) && + (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) { + vlan_name_type = args.u.name_type; -- 2.47.3